CVE-2023-38890

Deeper analysis

Online Shopping Portal Project version 3.1 contains a SQL injection vulnerability tracked as CVE-2023-38890. The flaw stems from insufficient validation of user-supplied input in the username field of the login form, allowing remote attackers to inject and execute arbitrary SQL commands or queries. The issue is classified under CWE-89 and carries a CVSS 3.1 base score of 8.8, reflecting high impact on confidentiality, integrity, and availability when successfully exploited.

An authenticated or unauthenticated attacker can submit crafted input through the login form to bypass authentication, extract or modify database contents, and potentially escalate privileges within the application. Public proof-of-concept code and an Exploit-DB entry demonstrate how the injection can be leveraged for unauthorized access and data manipulation without requiring elevated privileges beyond the login interface.

The EPSS score has remained flat at 0.0559 with no material increase since disclosure. Publicly available references include exploit code on GitHub and a technical write-up detailing the injection path, indicating that exploitation details have been shared in the security research community. No official vendor advisories or patches appear among the referenced sources.